Email/password authentication in Supabase - Step-by-Step Execution

Process Flow - Email/password authentication

User enters email & password

↓

Send credentials to Supabase Auth

↓

Supabase checks credentials

↓

Create session

↓

User logged in

User inputs email and password, Supabase verifies them, then either logs the user in or shows an error.

Execution Sample

Supabase

const { data, error } = await supabase.auth.signInWithPassword({
  email: '[e-mail]',
  password: 'password123'
})

This code sends the email and password to Supabase to authenticate the user.

Process Table

Step	Action	Input	Supabase Response	Result
1	User inputs email and password	email='[e-mail]', password='password123'	N/A	Credentials ready to send
2	Send credentials to Supabase	Credentials sent	Checking credentials	Waiting for response
3	Supabase verifies credentials	Email and password	Valid user found	Session created
4	Return session data	Session token	Session token returned	User logged in
5	If credentials invalid	Wrong email or password	Error returned	Show error message

💡 Execution stops after Supabase returns session or error response.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
email	undefined	'[e-mail]'	'[e-mail]'	'[e-mail]'	'[e-mail]'
password	undefined	'password123'	'password123'	'password123'	'password123'
data	undefined	undefined	undefined	{ session: {...} }	{ session: {...} }
error	undefined	undefined	undefined	null	null

Key Moments - 3 Insights

Why do we wait after sending credentials to Supabase?

Because Supabase needs time to check the credentials and respond, as shown in step 2 and 3 of the execution_table.

What happens if the email or password is wrong?

Supabase returns an error instead of a session, as shown in step 5 of the execution_table.

Why do we store the session token after login?

The session token keeps the user logged in for future requests, shown in step 4 where session data is returned.

Visual Quiz - 3 Questions

Look at the execution_table, what is the Supabase response at step 3?

A Credentials sent

B Valid user found

C Error returned

D Session token returned

💡 Hint

Check the 'Supabase Response' column in row for step 3.

At which step does the user get logged in?

A Step 5

B Step 2

C Step 4

D Step 1

💡 Hint

Look at the 'Result' column for when the user is logged in.

If the password is incorrect, which step shows the error?

A Step 5

B Step 3

C Step 4

D Step 2

💡 Hint

See the 'Result' column where error message is shown.

Concept Snapshot

Email/password authentication with Supabase:
- User inputs email and password
- Credentials sent to Supabase Auth
- Supabase verifies credentials
- If valid, session created and user logged in
- If invalid, error returned
Use supabase.auth.signInWithPassword({email, password})

Full Transcript

This visual execution shows how email and password authentication works with Supabase. First, the user enters their email and password. These credentials are sent to Supabase's authentication service. Supabase checks if the credentials match a registered user. If they do, Supabase creates a session and returns a session token, logging the user in. If the credentials are wrong, Supabase returns an error message. Variables like email, password, data, and error change as the process moves forward. Key moments include waiting for Supabase's response, handling errors, and storing the session token. The quiz questions help reinforce understanding by referencing specific steps in the execution table.

Practice

1. What is the primary purpose of using signUp in Supabase email/password authentication?

easy

A. To register a new user with email and password

B. To log in an existing user

C. To reset a user's password

D. To delete a user account

Solution

1. Step 1: Understand the function of signUp

   The signUp method is used to create a new user account with an email and password.

2. Step 2: Differentiate from other authentication methods

   Logging in uses signInWithPassword, not signUp. Password reset and deletion are separate actions.

3. Final Answer:

   To register a new user with email and password -> Option A

4. Quick Check:

   signUp = register new user [OK]

Hint: Remember: signUp means create account, not login [OK]

Common Mistakes:

• Confusing signUp with signInWithPassword
• Thinking signUp resets passwords
• Assuming signUp deletes accounts

2. Which of the following is the correct syntax to sign in a user with email and password using Supabase?

easy

A. supabase.auth.login({ email: '[e-mail]', password: 'pass123' })

B. supabase.auth.signInWithPassword({ email: '[e-mail]', password: 'pass123' })

C. supabase.auth.signUp({ email: '[e-mail]', password: 'pass123' })

D. supabase.auth.authenticate({ email: '[e-mail]', password: 'pass123' })

Solution

1. Step 1: Identify the correct method for signing in

   The method to sign in with email and password is signInWithPassword.

2. Step 2: Check the syntax format

   The correct syntax uses an object with email and password keys inside signInWithPassword.

3. Final Answer:

   supabase.auth.signInWithPassword({ email: '[e-mail]', password: 'pass123' }) -> Option B

4. Quick Check:

   signInWithPassword = login syntax [OK]

Hint: signInWithPassword is for login, signUp is for registration [OK]

Common Mistakes:

• Using signUp instead of signInWithPassword to login
• Using non-existent methods like login or authenticate
• Incorrect object structure in method call

3. What will be the result of this code snippet?

const { data, error } = await supabase.auth.signUp({ email: '[e-mail]', password: '123' });
console.log(error ? error.message : 'User created');

medium

A. Password should be at least 6 characters

B. User created

C. Email already exists

D. SyntaxError

Solution

1. Step 1: Analyze the password length

   The password '123' is only 3 characters, which is too short for Supabase's minimum password length (usually 6).

2. Step 2: Understand error handling

   The error object will contain a message about the weak password, so the console logs that message.

3. Final Answer:

   Password should be at least 6 characters -> Option A

4. Quick Check:

   Short password triggers error message [OK]

Hint: Passwords must meet minimum length to avoid errors [OK]

Common Mistakes:

• Assuming user is created with short password
• Ignoring error object and expecting success
• Confusing error messages for duplicate email

4. You wrote this code to sign in a user:

const { data, error } = await supabase.auth.signInWithPassword({ email: '[e-mail]' });

Why does it fail and how to fix it?

medium

A. Use signUp instead of signInWithPassword

B. Email format is wrong; fix the email string

C. Missing password field; add password to the object

D. signInWithPassword requires a callback function

Solution

1. Step 1: Check required parameters for signInWithPassword

   The method requires both email and password fields to authenticate.

2. Step 2: Identify missing password

   The code only provides email, so it fails. Adding password fixes the issue.

3. Final Answer:

   Missing password field; add password to the object -> Option C

4. Quick Check:

   Both email and password needed for signInWithPassword [OK]

Hint: Always provide both email and password to signInWithPassword [OK]

Common Mistakes:

• Omitting password when signing in
• Confusing signUp and signInWithPassword usage
• Thinking signInWithPassword needs a callback

5. You want to create a secure signup flow that prevents duplicate emails and weak passwords. Which approach is best?

hard

A. Call signInWithPassword first, then signUp if login fails

B. Allow signup without email verification to speed up user creation

C. Only check password length on client side, skip server validation

D. Use signUp and check error for duplicates or weak passwords before confirming success

Solution

1. Step 1: Use signUp to register users

   This method handles creating accounts and returns errors for duplicates or weak passwords.

2. Step 2: Check the error object to handle issues

   By checking error, you can inform users about duplicates or weak passwords and prevent bad signups.

3. Final Answer:

   Use signUp and check error for duplicates or weak passwords before confirming success -> Option D

4. Quick Check:

   signUp + error check = secure signup flow [OK]

Hint: Always check errors after signUp to catch duplicates and weak passwords [OK]

Common Mistakes:

• Trying to sign in before signup to check duplicates
• Skipping server-side password validation
• Ignoring email verification importance